Pages

Friday, October 4, 2013

Outlook recycles and re-uses old addresses

Users who are using the Outlook e-mail service by Microsoft need to be aware that their e-mail address may be recycled and given to someone else if they do not login occasionally.

It is well known that the free e-mail services through Hotmail and Yahoo Mail have enforced a user activity requirement to keep their e-mail accounts active. Inactive accounts will eventually be deleted and the e-mail address will be available for registration for other people. This clearly and obviously poses security issues since most online services authenticate and perform password resets through e-mail addresses.

However, while the above was known, it has now been revealed that Microsoft Outlook also enforce activity requirements and as well will recycle and re-use old inactive e-mail addresses. According to the user agreement text, users must login at least once every 270 days (~ 9 months) to ensure that their accounts are active. Otherwise, the accounts will be disabled and eventually deleted altogether which frees up the e-mail address that can be registered by someone else.

According to Microsoft and Yahoo, necessary precautions are taken to prevent sensitive information from reaching reused e-mails. Although exactly how this can be done is a mystery and definitely nothing that users who realize their e-mails have been assigned to someone else should trust upon.